{"uuid": "6a46de22-66ae-40d8-8d02-355fc26442df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1281", "type": "seen", "source": "https://t.me/CyberDispatch/716", "content": "417 exploitation sessions from 8 unique source IP addresses between February 1 and 9, 2026. An estimated 346 exploitation sessions have originated from 193.24.123[.]42, accounting for 83% of all attempts.\n\nThe malicious activity is designed to exploit CVE-2026-1281 (CVSS scores: 9.8), one of the two critical security vulnerabilities in EPMM, along with CVE-2026-1340 that could be exploited by an attacker to achieve unauthenticated remote code execution. Late last month, Ivanti acknowledged it's aware of a \"very limited number of customers\" who were impacted following the zero-day exploitation of the issues.", "creation_timestamp": "2026-08-30T00:00:47.568584Z"}